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Memorandum 


_To +: SAC, WMFO (264B-WF-181147) (@ Date =: 10/2/92 
b7c¢ 
Subject: UNSUB(S) ; 


INTRUSION INTO COMPUTER SYSTEMS OF EQUIFAX, 

at Sacramento, CA, Seattle, WA and New York, NY; 
CFA 

00: WMFO 


A review of captioned matter for file review revealed 
that captioned matter is a closed investigation as indicated on 
serial #4. However, the current status is pending. It is 
recommended that captioned matter be closed insofar as the 
investigation has been referred to the United Stated Secret 

. Service (USSS) which maintains jurisdiction over such matters. 
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FBI 
TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
IX] Teletype [] Immediate C] ¥OP-SECRET 
[] Facsimile [X] Priority [] SREREF 
[] AIRTEL (1 Routine 


Cl CONFIDENTEAL 
[C] UNCLASEFTO 
[x] UNCLAS 


Date__ 6/18/92 


FM FBI WMFO (264B-WF-NEW) C 
TO DIRECTOR FBI/PRIORITY/ 
FBI ATLANTA/PRIORITY/ 

FBI NEW YORK/PRIORITY/ 

FBI SACRAMENTO/PRIORITY/ 
FBI SAN FRANCISCO/PRIORITY/ 
FBI SEATTLE/PRIORITY/ 

BT 

UNCLAS 


CITE: //3920// 


SUBJECT: UNSUB; INTRUSIONS INTO COMPUTER SYSTEMS OF EQUIFAX, 
INC., AT SACRAMENTO, CALIFORNIA, SEATTLE, WASHINGTON, AND NEW 
YORK, NEW YORK; CFA; OO: WMFO. 

RE WMFO TELETYPE TO BUREAU DATED 6/17/92, WMFO FAXS TO AT 


AND SC ON 6/17/92, AND TELEPHONE CALLS FROM sst b6 


a) 
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APAGE 2 264B-WF-NEW UNCLAS 
[__| wwro, anp sale, aND ssaf_ AT, ON aa 
6/17/92. 
ALL OFFICES DISCONTINUE INVESTIGATION. 
BASED ON THE MEMORANDUM BETWEEN THE FBI AND THE U.S. 
SECRET SERVICE (USSS), USSS HAS PRIMARY JURISDICTION IN 
COMPUTER CRIMES INVOLVING CREDIT REPORTING AGENCIES. 
on e/izyozt uss, ee 
WAS ADVISED OF THIS INVESTIGATION.[ __| SUBSEQUENTLY ADVISED 
USSS WOULD EXERCISE THE PROVISIONS OF THE MOU, TAKE OVER THE 
INVESTIGATION, AND DID NOT DESIRE TO CONDUCT A JOINT 
INVESTIGATION. 
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VREAD 956/170 & Vag ie & 


0000 MRI oosk. 

PF RUCNFE FEIAT FEINY FBISC FRISF FEISE 
DE FRIWMFO #0028 1701529 
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FM FEI WMFO (2é448-WF-NEW) C 
TO DIRECTOR FREI/FRIORITY/ 
FET ATLANTA/FPRIGRITY/ 

FEI NEW YORE/FPRIOQRITY/ 

FEI SACRAMENTO/PRIORITY/ 
FET SAN FRANCISCO/FRIORITY / 
FET SEATTLE/PRIOQRITY/ 

BT 
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SUBJECT: UNSLIEs INTRUSIONS INTO COMPUTER SYSTEMS OF EMUIFAX, 
ING., AT SS4CRAMENTO, CALIFORNIA, SEATTLE, WASHINGTON, AND NEW 
YORE, NEW YORE: CFA: O02: WMFd. 


RE WMFO TELETYPE TO BUREAU DATED 4/17/72, WFO FAXS To AT 


AND SC ON 4/17/72, AND TELEPHONE CALLS FROM — 
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ALL OFFICES DISCONTINUE INVESTIGATION. 

BASED ON THE MEMORANDUM BETWEEN THE FEI AND THE U.S. 
SECRET SERVICE (USSS), USSS HAS PRIMARY JURISDICTION IN 
COMPLITER CRIMES INVOLVING CREDIT REPORTING AGENCIES. 

ON 62/17/92, [sss 
WAS ADVISED OF THIS INVESTIGATION. [| [SUBSEQUENTLY ADVISED 
SSS WOULD EXERCISE THE PROVISIONS OF THE MOL, TAKE OVER THE 
INVESTIGATION, AND DID NOT DESIRE TO CONDUCT A JOINT 


INVESTIGATION. 
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FM FBI WMFO (264B-WF-NEW) 
TO DIRECTOR FBI/PRIORITY/ 
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FBI SACRAMENTO/PRIORITY/ 
FBI SAN FRANCISCO/PRIORITY/ 
FBI SEATTLE/PRIORITY/ 

FBI NEW YORK/PRIORITY/ 
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PASS: FBIHQ ECU. 


SUBJECT: UNSUB; INTRUSIONS INTO COMPUTER SYSTEMS OF EQUIFAX, 
INC., AT SACRAMENTO, CA., SEATTLE, WASHINGTON, AND NEW YORK, 
NEW YORK; CFA; OO:WMFO. . b6 
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RE TELEPHONE CALLS TO ssa) si an sal aes 
[____] sacramento, AND RELIEF supeRvisoR| | SF, ON 


6/16/92. 


[ ___) retepHonzeatiy ADVISED WMFO ON 6/16/92, THAT EQUIFAX 


IS BEING PENETRATED BY COMPUTER HACKERS USING A FOLEY 


DEPARTMENT STORE ACCOUNT. FOLEY IS LOCATED IN HOUSTON, TEXAS. 
PENETRATIONS ARE OCCURRING PRIMARILY IN SACRAMENTO, CA., AND 
ALSO IN SEATTLE AND NEW YORK CITY. 

EQUIFAX CONTACTED PACBELL AND REQUESTED TRAP AND TRACE. 
PACBELL ADVISED EQUIFAX ON 6/16/92, THAT TRAP AND TRACE 
INFORMATION COULD NOT BE FURNISHED TO EQUIFAX WITHOUT A COURT 


ORDER. 
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“PAGE 3 264B-WF-NEW UNCLAS 


SECURITY, [ IS WORKING ON THE EQUIFAX TRAP AND 


TRACE. 

THE EQUIFAX SACRAMENTO COMPUTER CENTER HAS NUMEROUS PORTS 
AND THE SUBJECTS ARE USING VARYING PORTS. [  wrun FAX WMFO 
A COPY OF THE INCOMING TELEPHONE LINES BEING USED. 


THE COMPUTER CRIME SQUAD (C-17) AT WMFO HAS AGENTS WHO 


HAVE BEEN COMMERCIALLY TRAINED wl 
[ay THESE AGENTS ALSO HAVE PRACTICAL 


EXPERIENCE IN TELECOMMUNICATIONS. 

WMFO MAY REQUEST OF AT, SC, AND SF APPROVAL FOR sa[ | 
[__]T0 TRAVEL TO THESE DIVISIONS TO CONDUCT THE 
INVESTIGATION WITH A REPRESENTATIVE OF THE RESPECTIVE 
DIVISION. A SUBPOENA AND TRIP AND TRACE ORDER WILL BE 
REQUIRED. 

IT IS EXPECTED THE COMPUTER HACKERS ARE NOT LOCATED IN 
CALIFORNIA, BUT FROM OTHER AREAS OF THE COUNTRY OR 
INTERNATIONAL. THEREFORE,|———S—S—~*~SC=*«dCCOOMPUUTTERR 
CRIMES UNIT, DOJ, HAS BEEN BRIEFED ON THE INVESTIGATION AND 


WILL BE COORDINATING THE VARIOUS USA OFFICES. 
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ANY QUESTIONS MAY BE DIRECTED TO sal sd a 


WMFO, EXTENSION 9164, 6364. 
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SUBIEDT: UNSUB: INTRUSIONS INTO COMPUTER SYSTEMS OF EQUIFAX, 
INC., AT SACRAMENTO, CA., SEATTLE, WASHINGTON. AND NEW YORE, 


NEW YORE; CFA: O0sWMFO. 


RE TELEPHONE CALLS To saat ANE! = ane 


bY Buf - 1/14 I- 
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PAGE TWO DE FRIWMFO 0023 LINCLAS 
[ __|sacramenro, AND RELIEF suPeRVisoR[ | SF, ON 
B/1G/ 9%. 
[tr ax, INCL, ATLANTA, ca.[ | 
[ TELEPHONICALLY ALVISED WFO GN 6/16/92, THAT EGUIFAX 
IS BEING PENETRATED BY COMPUTER HACKERS USING A FOLEY 
DEPARTMENT STORE ACCOUNT. FOLEY IS LOCATED IN HOUSTON, TEXAS. 
PENETRATIONS ARE CCCURRING PRIMARILY IN SACRAMENTO, CA., ANTI 
ALSC IN SEATTLE AND NEW YORK CITY. 
EQUIFAX CONTACTED PACBELL AND REQUESTED TRAF ANID TRACE. 
PACBELL ADVISED EQUIFAX ON 4/14/92, THAT TRAF AND TRACE 
INFORMATION COULD NOT BE FURNISHED TO EQUIFAX WITHOUT A COURT 


OROER . 
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AND THE SUBJECTS ARE USING VARYING PorTS. [ [WILL FAX wWMFO oo 
A COPY OF THE INCOMING TELEPHONE LINES BEING USED. 
THE COMPUTER CRIME SQUAD (C-17) AT WMFO HAS AGENTS WHO 
HAVE BEEN COMMERCIALLY TRAINED IN[ aa 
[sO THESE AGENTS ALSO HAVE PRACTICAL 
EXPERIENCE IN TELECOMMUNICATIONS. 
WMFO MAY REQUEST OF AT, SC, AND SF APPROVAL FOR S4[ | 
[sta TRAVEL TO THESE DIVISIONS TO CONDUCT THE ee 
INVESTIGATION WITH A REPRESENTATIVE OF THE RESPECTIVE 
DIVISION. A SUBPOENA AND TRIP AND TRACE ORDER WILL BE 
REGUIRED. 
IT IS EXPECTED THE COMPUTER HACKERS ARE NOT LOCATED IN 
| CALIFORNIA, ELT FROM OTHER AREAS OF THE COUNTRY OR 
INTERNATIONAL. THEREFORE,[ sOMPUTER mae 
CRIMES UNIT, DJ, HOS BEEN BRIEFED ON THE INVESTIGATION ANE! 
WILL BE COORDINATING THE VARIOUS USA OFFICES. 
ANY QUESTIONS MAY BE DIRECTED TO ssat i 


WMFO, EXTENSION ?ie4, 2364. 
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COMPUTE. FRASD AND ABUSE DATA ...:. FORM 


FD-801 (11-6-91) 


AIRTEL 
To : Director, FBI 
(Attn: Economic Crimes Unit . 
White-Collar Crimes Section ae 


Criminal Investigative Division) 


‘From : SAC} WMFO (264B-WF-181147) (C) 


TITLE : UNSUB(s); oe 
INTRUSION INTO COMPUTER SYSTEMS OF EQUIFAX., 
at SACRAMENTO, CA, SEATTLE, WA and NEW YORK, 
YORK - Victim; : a “ . : 
COMPUTER FRAUD AND ABUSE 
00 : WMFO 


REFERENCE: WMFO teletypes to the Director, dated. 6/17/92 and 6/18/92 


Check Box e ibs * eye 


Bl Enclosed are the original and five copies of a LEM for dissemination. 
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Submission: © KX Initial [] Supplemental 


6/18/92 Date case opened (if applicable) 
“6/17/92 Date of complaint = = 
6/9/92 Date of first known offense/intrusion 
Unknown - Estimated mmber of computer users affected. ° 
$ Unknown - Estimated loss to date. 
Unknown - - see “__. -Brand and series model of computer. 
"(ier IBM, DEC, Apple, etc.) 
om : cris aaa $ ied Tt rrr tee ete ee! pitas | 
Unknown ” Operating system and version. — | 


3 - Bureau 2b648B- UF - he ae A 
(1 - ECU, WCCS, CID) | a Vee ae oe ae 
(1 - CI-4D, INTD) : 4A Seen Dita is 
Q - Field Office “Bae FBI/DOJ 
a : 


Bsbeb \ 
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Fill in below with Yes (¥), No (N), or Unknown (0): 


N Is a federal government computer affected? 
Department /Agency: 


yo. Is a federal interest computer affected? 
Victim institution: FOLEY DEPARTMENT STORES, Houston, TX 


"n Y | Does che offense involve a telecommmications network? 
U Is (former) employee suspected? 


Tia 


N Does agency/institution computers contain classified information? 
N Was classified information compromised in this matter? 
N Is a foreign or hostile intelligence service involved? 


. ~. Check Type Of Grime(s): 
IMPATRMENT (264-A) THEFT OF INFORMATION (264-B) 


(] Virus Planted LI Data 
(C] Malicious Software Planted [] Passwords 
[J Interruption of Service/Prevent use EX Computer Processing Time 
[] Destruction of Information or Software.. [J] Telephone Services 
[] Modification of Information or Software (CJ Application Software 
: ([ Operationg System Software 


te 


INTRUSION (264-C) 


EX Unauthorized Access 
[-] Exceeding Authorized Access 


Check Action Taken: 


i<]. Case Opened/Reopened/Incorporated into Pending Matter 

[LJ No Action Bue to State/Local Prosecution 

[J USA Declination 

[| Facts Known do not meet Prosecutive Guidelines 

K] Matter Referred to Another Federal Agency (U.S. Secret Service) 
(] Investigation Delayed Due to Lack of Resources 

(1) Other: 


Bomintscretive: Investigation was opened and subsequently it was discovered 
that investigation falls within the jurisdiction of the. USSS. The FBI 
discontinued and referred to USSS. Prior to discontinuance, FBI Bie 


This document contains neither recommendations nor conclusions of the FBI. 
your agency; it and its contents are not to be distributed outside your agency. 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to Washington D. C. 20535 
FileNo. 264B-WF-181147 
June 26, 1992 


UNSUB 
INTRUSION INTO COMPUTER 
SYSTEMS OF EQUIFAX, INC., 
AT SACRAMENTO, CALIFORNIA, 
SEATTLE, WASHINGTON AND 
NEW YORK, NEW YORK 
COMPUTER FRAUD AND ABUSE 


On June 16, 1992, captioned investigation was 


j upon receipt of information from 
Equifax, Inc., Atlanta, Georgia, indicating that 


computer systems operated by Equifax had been and were currently 
being penetrated by unknown system intruders utilizing a Foley 
Department Store access code. The headquarters for Foley 
Department Stores is located in Houston, Texas but the system 
intrusions occurred primarily in Sacramento, California, Seattle, 
Washington and New York, New York. 


On June 16, 199 the known facts of this investigation 
were presented to Computer Crimes Unit, 
Department of Justice, who advised that he would coordinate the 


prosecution of this investigation through the various offices of 
the United States Attorney. 


On June 17, 1992, captioned investigation ws 
discontinued following a review of the Memorandum of 
Understanding (MOU) between the Federal Bureau of Investigation 
(FBI) and the United States Secret Service (USSS) which revealed 
that the USSS maintains primary jurisdiction in computer crimes 


involving credit reporting agencies. uifax is 
considered a credit reporting agency, Electronic 
Crimes Branch, USSS, was apprised of the facts of the 
investigation. subsequently advised that the USSS would 


exercise the provisions of th y taking over the 
investigation. Additionally, stated the USSS did not 


desire to conduct a joint investigation with the FBI. 
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Memorandum 


To 


sac, wuro [+d () Da 


10/2/92 b7E 
From : b6 
b7Cc 
CFA 
00:PD 
Since the middle of July, 1992, the writer has been 
involved with captioned matter on a virtual full-time basis. The 
i b7E 
such the writer has been unavailable to address the following 
cases: 
b7E 
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‘EQUIFAX _ 


The b6 
Information ms 
Source 


Equifax Credit Information Services, Inc. 
1525 Windward Concourse 
Alpharetta, Georgia ane 
seep (404) 740-764 
AX (404) 740- sit 


DATE; 6/17/92 
ro; _L ___] prc 


FAX # (202) 324-6363 


# PAGES 2 
Including Cover 


es + MESSAGE - oe 
Here is the request thatI madetd ——=————_—sd| Pac-Tel oar 
regarding his support to help us find who the person(s) are 

that are stealing Equifax file information, This regards a stolen 

access code that our Equifax affiliate in Houston, Texas had 

assigned to Foleys Department Store. 


The characteristics of this case are the same as a similar event 
that happened during April and May to our Brooks Brothers 
customer in New York, In that case, there were about 4,000 
unauthorized accesses of our database. The Foley case is now 
close to 2,000 unauthorized accesses. 


We need to catch these perpetrators! 
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